Fair Credit Reporting

Background

The Fair Credit Reporting Act (FCRA) deals with the rights of consumers in relation to their credit reports and the obligations of credit reporting agencies and the businesses that provide information to them. The FCRA has been revised numerous times since it took effect in 1971, notably by passage of the Consumer Credit Reporting Reform Act of 1996, the Gramm-Leach-Bliley Act of 1999, and the Fair and Accurate Credit Transactions Act of 2003 (FACT Act).

The FACT Act created new responsibilities for consumer reporting agencies and users of con­sumer reports, many concerning consumer disclo­sures and identity theft. It also created new rights for consumers, including the right to free annual consumer reports and improved access to report information, with the aim of making data in the consumer reporting system more accurate.

Coverage

Business entities that are consumer reporting agencies have significant responsibilities under the FCRA; business entities that are not consumer reporting agencies have somewhat lesser respon­sibilities. Generally, financial institutions are not considered consumer reporting agencies; how­ever, those that engage in certain types of information-sharing practices can be deemed con­sumer reporting agencies. In addition, the FCRA applies to financial institutions that operate as

• Procurers and users of information (for example, when granting credit, purchasing dealer paper, or opening deposit accounts),

• Furnishers and transmitters of information (by reporting information to consumer reporting agen­cies or other third parties, or to affiliates),

• Marketers of credit or insurance products, or

• Employers.

Key Definitions

Key definitions used throughout the FCRA include the following:

Consumer

A consumer is an individual.

Consumer Report

A consumer report is any written, oral, or other communication of any information by a consumer reporting agency that bears on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal character­istics, or mode of living that is used (or is expected to be used) or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for

• Credit or insurance to be used primarily for personal, family, or household purposes;

• Employment purposes; or

• Any other purpose authorized under FCRA, section 604.

The term ‘‘consumer report’’ does not include

• Any report containing information solely about transactions or experiences between the con­sumer and the institution making the report;

• Any communication of that transaction or experi­ence information among entities related by common ownership or affiliated by corporate control (for example, different banks that are members of the same holding company, or subsidiary companies of a bank);

• Communication of other information among per­sons related by common ownership or affiliated by corporate control if

– It is clearly and conspicuously disclosed to the consumer that the information may be commu­nicated among such persons, and

– The consumer is given the opportunity, before the time the information is communicated, to direct that the information not be communi­cated among such persons;

• Any authorization or approval of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device;

• Any report in which a person who has been requested by a third party to make a specific extension of credit directly or indirectly to a consumer (such as a lender who has received a request from a broker) conveys his or her decision with respect to such request, if the third party advises the consumer of the name and address of the person to whom the request was made, and such person makes the disclosures to

Consumer Compliance Handbook FCRA • 1 (11/06)

1. Other FCRA provisions—including section 628 (Disposal Rules)—are covered in other functional examinations, such as safety and soundness examinations, and therefore are not part of these procedures.

Fair Credit Reporting

the consumer required under FCRA, section 615; or

• A communication described in FCRA, subsec­tion 603(o) or (x) (which relate to certain investi­gative reports and certain reports to prospective employers).

Person

A person is any individual, partnership, corpora­tion, trust, estate, cooperative, association, govern­ment or governmental subdivision or agency, or other entity.

Investigative Consumer Report

An investigative consumer report is a consumer report or portion thereof for which information on a consumer’s character, general reputation, per­sonal characteristics, or mode of living is obtained through personal interviews with neighbors, friends, or associates of the consumer, or with oth­ers with whom the consumer is acquainted or who may have knowledge concerning any such infor­mation. However, such information does not include specific factual information on a consum­er’s credit record obtained directly from a creditor of the consumer or from a consumer reporting agency when such information was obtained directly from a creditor of the consumer or from the consumer.

Adverse Action

With regard to credit transactions, the term adverse action has the same meaning as used in sec­tion 701(d)(6) of the Equal Credit Opportunity Act (ECOA), Regulation B, and the official staff com­mentary. Under the ECOA, an ‘‘adverse action’’ is a denial or revocation of credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in substantially the same amount or on terms substantially similar to those requested. Under the ECOA, the term does not include a refusal to extend additional credit under an existing credit arrangement when the applicant is delin­quent or otherwise in default, or when such additional credit would exceed a previously estab­lished credit limit.

For non-credit transactions, the term has the following additional meanings for purposes of the FCRA:

• A denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of any insurance, existing or applied for, in connection with the underwriting of insurance

• A denial of employment, or any other decision for

2 (11/06) • FCRA

employment purposes that adversely affects any current or prospective employee

• A denial or cancellation of, an increase in any charge for, or any other adverse or unfavorable change in the terms of any license or benefit described in FCRA, section 604(a)(3)(D)

• An action taken or determination that (1) is made in connection with an application made by, or transaction initiated by, any consumer, or in connection with a review of an account to determine whether the consumer continues to meet the terms of the account, and (2) is adverse to the interests of the consumer

Employment Purposes

A consumer report used for employment purposes is a report used for the purpose of evaluating a consumer for employment, promotion, reassign­ment, or retention as an employee.

Consumer Reporting Agency

A consumer reporting agency is any person that (1) for monetary fees, dues, or on a cooperative nonprofit basis regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information, or other information on consumers, for the purpose of furnishing consumer reports to third parties, and (2) uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.

Implementation of the FCRA

Some of the requirements for financial institutions imposed by the FCRA are written directly into the statute; others are contained in regulations issued jointly by the FFIEC agencies; still others are spelled out in regulations issued by the Federal Reserve Board and/or the Federal Trade Commission.

For examination purposes, similar requirements have been grouped together, creating a series of examination modules. The five modules that have been completed to date cover requirements appli­cable to financial institutions that are not consumer reporting agencies. A sixth module will cover institutions that are considered consumer reporting agencies. The five completed examination mod­ules are listed below with the statutory or regulatory cites for the FCRA requirements they cover.1

Consumer Compliance Handbook

Fair Credit Reporting

Module 1: Obtaining Consumer Reports

• Permissible Purposes of Consumer Reports, and Investigative Consumer Reports—FCRA, Sec­tions 604 and 606

Module 2: Obtaining Information and Sharing among Affiliates

• Consumer Report and Information Sharing— FCRA, Section 603(d)

• Protection of Medical Information—FCRA, Sec­tion 604(g), and Regulation V, Subpart D

• Affiliate Marketing Opt-Out—FCRA, Section 624

Module 3: Disclosures to Consumers and Miscellaneous Requirements

• Use of Consumer Reports for Employment Purposes—FCRA, Section 604(b)

• Prescreened Consumer Reports and Opt-Out Notice—FCRA, Sections 604(c) and 615(d); FTC Regulations, Parts 642 and 698

• Truncation of Credit and Debit Card Account Numbers—FCRA, Section 605(g)

• Disclosure of Credit Scores by Certain Mortgage Lenders—FCRA, Section 609(g)

• Adverse Action Disclosures—FCRA, Sections 615(a) and (b)

• Debt Collector Communications concerning Iden­tity Theft—FCRA, Section 615(g)

• Risk-Based Pricing Notice—FCRA, Section 615(h)

Module 4: Financial Institutions as Furnishers of Information

• Furnishers of Information—General—FCRA, Sec­tion 623

• Prevention of Re-Pollution of Consumer Reports— FCRA, Section 623(a)(6)

• Negative Information Notice—FCRA, Section 623(a)(7)

Module 5: Consumer Alerts and Identity Theft Protections

• Fraud and Active Duty Alerts—FCRA, Section 605A(h)

• Information Available to Victims—FCRA, Section 609(e)

Module 6: Requirements for Consumer Reporting Agencies

Organization of Examination Procedures

The modules in this chapter contain both general information about each of the requirements and examination procedures. Preceding the modules are the objectives and initial procedures for fair credit reporting examinations.

Consumer Compliance Handbook FCRA • 3 (11/06)

Fair Credit Reporting Examination Objectives and Initial Examination Procedures

EXAMINATION OBJECTIVES

1. To determine the financial institution’s compli­ance with the FCRA

2. To assess the quality of the financial institution’s compliance management systems and its poli­cies and procedures for implementing the FCRA

3. To determine the reliance that can be placed on the financial institution’s internal controls and procedures for monitoring the institution’s com­pliance with the FCRA

4. To direct corrective action when violations of law are identified or when policies or internal con­trols are deficient

INITIAL EXAMINATION PROCEDURES

The initial examination procedures are designed to acquaint examiners with the operations and pro­cesses of the institution being examined. They focus on the institution’s systems, controls, poli­cies, and procedures, including audits and previ­ous examination findings.

The applicability of the various sections of the FCRA and the implementing regulations depends on an institution’s unique operations. The func­tional examination requirements for an institution’s FCRA responsibilities are presented topically in modules 1 through 6.

Initially, examiners should

1. Through discussions with management and a review of available information, determine whether the institution’s internal controls are adequate to ensure compliance in the area under review. Consider the following:

a. Organization charts

b. Process flowcharts

c. Policies and procedures

d. Loan documentation

e. Checklists

f. Computer program documentation (for example, records that illustrate the fields and types of data reported to consumer reporting agencies, and automated records that track customer opt-outs for FCRA affiliate informa­tion sharing)

2. Review any compliance audit material, including workpapers and reports, to determine whether

a. The scope of the audit addresses all provi­sions as applicable;

b. Corrective actions were taken to follow up on previously identified deficiencies;

c. The testing includes samples covering all product types and decision centers;

d. The work performed is accurate;

e. Significant deficiencies and their causes are included in reports to management and/or to the board of directors; and

f. The frequency of review is appropriate.

3. Review the financial institution’s training materi­als to determine whether

a. Appropriate training is provided to individu­als responsible for FCRA compliance and operational procedures, and

b. The training is comprehensive and covers the various aspects of the FCRA that apply to the individual financial institution’s operations.

4. Through discussions with management, deter­mine which portions of the six examination modules will apply.

5. Complete appropriate examination modules; document and form conclusions regarding the quality of the financial institution’s compliance management systems and compliance with the FCRA.

Consumer Compliance Handbook FCRA • 5 (11/06)

2. Use of consumer reports for employment purposes requires specific advance authorization and disclosure notices and, if applicable, adverse action notices. These issues are addressed in module 3 of these examination procedures.

Fair Credit Reporting Examination Module 1: Obtaining Consumer Reports

Overview

Consumer reporting agencies have a significant amount of personal information about consumers. This information is invaluable in assessing a consumer’s creditworthiness for a variety of products and services, including loan and deposit accounts, insurance, and telephone services. Access to this information is governed by the Fair Credit Reporting Act (FCRA) to ensure that it is obtained for permissible purposes and is not used for illegitimate purposes.

The FCRA requires any prospective ‘‘user’’ of a consumer report—for example a lender, insurer, landlord, or employer—to have a legally permis­sible purpose for obtaining a report.

Permissible Purposes of Consumer Reports (FCRA, Section 604) and Investigative Consumer Reports (FCRA, Section 606)

Legally Permissible Purposes

The FCRA allows a consumer reporting agency to furnish a consumer report under the following circumstances and no other:

• In response to a court order or federal grand jury subpoena

• In accordance with the written instructions of the consumer

• To a person, including a financial institution, that it has reason to believe

– Intends to use the report in connection with a credit transaction involving the consumer (including extending, reviewing, and collecting credit);

– Intends to use the information for employment purposes;2

– Intends to use the information in connection with the underwriting of insurance involving the consumer;

– Intends to use the information in connection with a determination of the consumer’s eligibility for a license or other benefit granted by a governmental instrumentality that is required by

Consumer Compliance Handbook FCRA • 7 (11/06)

law to consider an applicant’s financial responsibility;

– Intends to use the information, as a potential investor or servicer or a current insurer, in connection with a valuation of, or an assess­ment of the credit or prepayment risks associ­ated with, an existing credit obligation; or

– Otherwise has a legitimate business need for the information

a. In connection with a business transaction that is initiated by the consumer, or

b. To review an account to determine whether the consumer continues to meet the terms of the account

• In response to a request by the head of a state or local child support enforcement agency (or authorized appointee), if the person certifies various information to the consumer reporting agency regarding the need to obtain the report. (Generally, a financial institution that is not a consumer reporting agency is not involved in such a situation.)

Prescreened Consumer Reports

Users of consumer reports, such as financial insti­tutions, are allowed to obtain prescreened con­sumer reports in order to make firm offers of credit or insurance to consumers, unless the consumers have elected to opt out of being included on pre-screened lists. The FCRA contains many require­ments, including an opt-out notice requirement, when prescreened consumer reports are used. In addition to defining prescreened consumer reports, module 3 covers these requirements.

Investigative Consumer Reports

FCRA, section 606, contains specific requirements concerning the use of investigative consumer reports. Such reports contain information about a consumer’s character, general reputation, personal characteristics, or mode of living that is obtained in whole or in part through personal interviews with the consumer’s neighbors, friends, or associates. If a financial institution procures an investigative con­sumer report, or causes one to be prepared, the institution must meet the following requirements:

• The institution must clearly and accurately dis­close to the consumer that an investigative consumer report may be obtained.

• The disclosure must contain a statement of the

Fair Credit Reporting: Examination Module 1

consumer’s right to request other information about the report and a summary of the consumer’s rights under the FCRA.

• The disclosure must be in writing and must be mailed or otherwise delivered to the consumer not later than three business days after the date on which the report was first requested.

• The financial institution procuring the report must certify to the consumer reporting agency that it has complied with the disclosure requirements and will comply in the event that the consumer requests additional disclosures about the report.

Institution Procedures

Given the preponderance of electronically avail­

able information and the growth of identity theft, financial institutions should manage the risks associated with obtaining and using consumer reports. They should employ procedures, controls, or other safeguards to ensure that consumer reports are obtained and used only in situations for which there are permissible purposes. Access to, storage of, and destruction of this information should be dealt with under an institution’s information-security program; however, obtaining consumer reports initially must be done in compli­ance with the FCRA.

8 (11/06) • FCRA Consumer Compliance Handbook

Fair Credit Reporting—Module 1 Examination Procedures

Permissible Purposes of Consumer Reports (FCRA, Section 604) and Investigative Consumer Reports (FCRA, Section 606) 1. Determine whether the financial institution obtains

consumer reports.

2. Determine whether the financial institution obtains prescreened consumer reports and/or reports for employment purposes. If it does, complete the appropriate sections of module 3.

3. Determine whether the financial institution pro­cures, or causes to be prepared, investigative consumer reports. If it does, determine whether the appropriate disclosure is given to consum­ers within the required time periods. In addition, determine whether the institution certifies com­pliance with the disclosure requirements to the consumer reporting agency.

4. Evaluate the financial institution’s procedures to ensure that consumer reports are obtained only for permissible purposes. Confirm that the institution certifies to the consumer reporting

agency the purposes for which it will obtain reports. (The certification is usually contained in the institution’s contract with the consumer reporting agency.)

5. If procedural weaknesses or other risks requir­ing further investigation are noted, such as the receipt of several consumer complaints, review a sample of consumer reports obtained from a consumer reporting agency and determine whether the financial institution had permissible purposes for obtaining the reports. For example,

• Obtain a copy of a billing statement or other list of consumer reports obtained by the financial institution from the consumer report­ing agency over a period of time.

• Compare this list, or a sample from this list, with the institution’s records to ensure that there was a permissible purpose for obtaining the report(s)—for instance, the consumer applied for credit, insurance, or employment. The institution may also obtain a report in connection with the review of an existing account.

Consumer Compliance Handbook FCRA • 9 (11/06)

Fair Credit Reporting Examination Module 2: Obtaining Information and Sharing among Affiliates

Overview

The Fair Credit Reporting Act (FCRA) sets forth many substantive compliance requirements for consumer reporting agencies that are designed to help ensure the accuracy and integrity of the consumer reporting system. As noted in the first section of this FCRA chapter, a consumer reporting agency is a person that generally furnishes con­sumer reports to third parties. By their very nature, banks, credit unions, and thrifts hold a significant amount of consumer information that could consti­tute a consumer report. Communication of this information could cause the institution to become a consumer reporting agency. The FCRA contains several exceptions that enable a financial institution to communicate this type of information, within strict guidelines, without becoming a consumer reporting agency.

Rather than containing strict information-sharing prohibitions, the FCRA creates a business disin­centive such that if a financial institution shares consumer report information outside of the excep­tions, the institution becomes a consumer reporting agency and is subject to the significant, substan­tive requirements of the FCRA applicable to those entities. Typically, a financial institution will struc­ture its information-sharing practices within the exceptions to avoid becoming a consumer report­ing agency. This examination module generally covers the information-sharing practices within these exceptions.

If upon completion of this module, examiners determine that the financial institution’s information-sharing practices fall outside of these exceptions, the institution may be considered a consumer reporting agency, and the examination procedures in module 6 should be completed.

Consumer Report and Information Sharing (FCRA, Section 603(d))

FCRA, section 603(d), defines a consumer report to include information about a consumer that bears on a consumer’s creditworthiness, character, and credit capacity, among other characteristics. Com­munication of this information may cause a person, including a financial institution, to become a consumer reporting agency. The statutory defini­tion contains key exceptions to this definition that enable a financial institution to share this type of information under certain circumstances without becoming a consumer reporting agency. Specifi­

cally, the term ‘‘consumer report’’ does not include the following:

• A report containing information solely related to transactions or experiences between the con­sumer and the financial institution making the report. A person, including a financial institution, may share information strictly related to its own transactions or experiences with a consumer (such as the consumer’s record with a loan or savings account at an institution) with any third party, without regard to affiliation, without becom­ing a consumer reporting agency. This type of information sharing may, however, be restricted under the Privacy of Consumer Financial Informa­tion regulations that implement the Gramm-Leach-Bliley Act (GLBA) because the information meets the definition of nonpublic personal information under the Privacy regulations; sharing it with nonaffiliated third parties may be subject to opt-out provisions under the Privacy regulations. In turn, the FCRA may restrict activities that the GLBA permits. For example, the GLBA permits a financial institution to share lists of its customers and information about those customers, such as their credit scores, with another financial institu­tion for the purpose of jointly marketing or sponsoring other financial products or services. Such a communication may be considered a consumer report under the FCRA and could cause the sharing institution to become a con­sumer reporting agency.

• Communication of such transaction or experi­ence information among persons, including finan­cial institutions, related by common ownership or affiliated by corporate control.

• Communication of other information (that is, other than transaction or experience information) among persons, including financial institutions, related by common ownership or affiliated by corporate control (1) if it is clearly and conspicu­ously disclosed to the consumer that the informa­tion will be communicated among such entities and (2) if, before the information is initially communicated, the consumer is given the oppor­tunity to opt out of the communication. Thus, a financial institution is allowed to share information (other than information about its own transactions or experiences) that could otherwise constitute a consumer report without becoming a consumer reporting agency under the following circum­stances:

– The sharing of the ‘‘other’’ information is done with affiliates

Consumer Compliance Handbook FCRA • 11 (11/06)

Fair Credit Reporting: Examination Module 2

– Consumers are provided with the notice and an opportunity to opt out of this sharing before the information is first communicated among affiliates

‘‘Other’’ information can include, for example, information provided by a consumer on an application form concerning accounts with other financial institutions. It can also include information obtained by a financial institution from a consumer reporting agency, such as the consumer’s credit score. If a financial institution shares other information with affili­ates without providing a notice and an opportunity to opt out, the institution may become a consumer reporting agency subject to the FCRA requirements.

The opt-out right required by this section must be stated in a financial institution’s privacy notice, as required by the GLBA and its implementing regulations.

Other Exceptions

Specific Extensions of Credit

In addition, the term ‘‘consumer report’’ does not include the communication of a specific extension of credit directly or indirectly by the issuer of a credit card or similar device. For example, this exception allows a lender to communicate an authorization through a credit card network to a retailer, to enable a consumer to complete a purchase using a credit card.

Credit Decision to Third Party

The term ‘‘consumer report’’ also does not include any report in which a person, including a financial institution, that has been requested by a third party (such as an automobile dealer) to make a specific extension of credit directly or indirectly to a consumer conveys the decision with respect to the request. The third party must advise the consumer of the name and address of the financial institution to which the request was made, and the financial institution must make the adverse action disclo­sures when required by FCRA, section 615. For example, this exception allows a lender to commu­nicate a credit decision to an automobile dealer that is arranging financing for the purchase of an automobile by a consumer who requires a loan to finance the transaction.

‘‘Joint User’’ Rule

The Federal Trade Commission staff commentary discusses another exception, known as the Joint User Rule. Under this exception, users of con­

sumer reports, including financial institutions, may share information with each other if they are jointly involved in the decision to approve a consumer’s request for a product or service, provided that each has a permissible purpose for obtaining a consumer report on the individual. For example, a consumer applies for a mortgage loan that will have a high loan-to-value ratio, and thus the lender will require private mortgage insurance (PMI) in order to approve the application. The PMI will be provided by an outside company. The lender and the PMI company may share con­sumer report information about the consumer because both entities have permissible purposes for obtaining the information and they are jointly involved in the decision to grant products to the consumer.

This exception applies both to entities that are affiliated and to nonaffiliated third parties. It is important to note that the GLBA still applies to the sharing of nonpublic personal information with nonaffiliated third parties; therefore, financial insti­tutions should be aware that sharing under the FCRA Joint User Rule may still be limited or prohibited by the GLBA.

Protection of Medical Information (FCRA, Section 604(g); and Regulation V, Subpart D)

Section 604(g) generally prohibits creditors from obtaining and using medical information in connec­tion with any determination of the consumer’s eligibility, or continued eligibility, for credit. The statute contains no prohibition regarding creditors’ obtaining or using medical information for other purposes that are not in connection with a determi­nation of the consumer’s eligibility, or continued eligibility, for credit.

Section 604(g)(5)(A) required the FFIEC agen­cies to prescribe regulations that permit transac­tions determined to be necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs (including administra­tive verification purposes) and that are consistent with the congressional intent to restrict the use of medical information for inappropriate purposes. The agencies published final rules in the Federal Register (70 FR 70664) on November 22, 2005; subpart D of Regulation V implements the require­ments for entities supervised by the Federal Reserve. The rules contain the general prohibition regarding obtaining or using medical information and provide exceptions for the limited circum­stances under which medical information may be used. The rules define ‘‘credit’’ and ‘‘creditor’’ as having the same meanings as in section 702 of the Equal Credit Opportunity Act.

12 (11/06) • FCRA Consumer Compliance Handbook

Fair Credit Reporting: Examination Module 2

Obtaining and Using Unsolicited Medical Information (Regulation V, § 222.30(c))

A creditor does not violate the prohibition on obtaining medical information if it receives the medical information pertaining to a consumer in connection with any determination of the consum­er’s eligibility, or continued eligibility, for credit without specifically requesting medical information. However, the creditor may use this medical infor­mation only in connection with a determination of the consumer’s eligibility, or continued eligibility, for credit in accordance with either the financial information exception or one of the specific other exceptions provided in the rules. These exceptions are discussed below.

Financial Information Exception (Regulation V, § 222.30(d))

A creditor is allowed to obtain and use medical information pertaining to a consumer in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit, so long as all of the following conditions are met:

• The information is the type of information routinely used in making credit eligibility determinations, such as information relating to debts, expenses, income, benefits, assets, collateral, or the pur­pose of the loan, including the use of the loan proceeds.

• The creditor uses the medical information in a manner and to an extent that is no less favorable than it would use comparable information that is not medical information in a credit transaction.

• The creditor does not take the consumer’s physical, mental, or behavioral health, condition or history, type of treatment, or prognosis into account as part of any such determination.

The financial information exception is designed in part to allow a creditor to consider a consumer’s medical debts and expenses in the assessment of that consumer’s ability to repay the loan according to the loan terms. The financial information exception also allows a creditor to consider the dollar amount and continued eligibility for disability income, worker’s compensation income, or other benefits related to health or a medical condition that is relied on as a source of repayment.

The creditor may use the medical information in a manner and to an extent that is no less favorable than it would use comparable nonmedical informa­tion. For example, a consumer includes on an application for credit information about two $20,000 debts. One debt is to a hospital; the other is to a retailer. The creditor may use and consider the debt

Consumer Compliance Handbook FCRA • 13 (11/06)

to the hospital in the same manner in which it considers the debt to the retailer, such as including the debts in the calculation of the consumer’s proposed debt-to-income ratio. In addition, the consumer’s history of payment of the debt to the hospital may be considered in the same manner as payment of the debt to the retailer. For example, if the creditor does not grant loans to applicants who have debts that are ninety days past due, the creditor could consider the past-due status of a debt to the hospital in the same manner as it considers the past-due status of a debt to the retailer.

A creditor may use medical information in a manner that is more favorable to the consumer, according to its regular policies and procedures. For example, if a creditor has a routine policy of declining consumers who have a ninety-day past-due installment loan to a retailer but does not decline consumers who have a ninety-day past-due debt to a hospital, the financial information exception would allow the creditor to continue this policy without violating the rules, because in such a case, the creditor’s treatment of the hospital debt is more favorable to the consumer.

A creditor may not take the consumer’s physical, mental, or behavioral health, condition or history, type of treatment, or prognosis into account as part of any determination regarding the consumer’s eligibility, or continued eligibility, for credit. The creditor may consider only the financial implications as discussed above, such as the status of a debt to a hospital or the continuance of disability income.

Specific Exceptions for Obtaining and Using Medical Information (Regulation V, § 222.30(e))

In addition to the financial information exception, the rules provide for the following nine specific exceptions under which a creditor may obtain and use medical information in its determination of the consumer’s eligibility, or continued eligibility, for credit:

1. To determine whether the use of a power of attorney or legal representative that is triggered by a medical condition or event is necessary and appropriate, or whether the consumer has the legal capacity to contract when a person seeks to exercise a power of attorney or act as a legal representative for a consumer on the basis of an asserted medical condition or event. For example, if person A is attempting to act on behalf of person B under a power of attorney that is invoked on the basis of a medical event, a creditor is allowed to obtain and use medical information to verify that person B has experi­enced a medical condition or event such that

Fair Credit Reporting: Examination Module 2

person A is allowed to act under the power of attorney.

2. To comply with applicable requirements of local, state, or federal laws

3. To determine, at the consumer’s request, whether the consumer qualifies for a legally permissible special credit program or credit-related assis­tance program that is

• Designed to meet the special needs of consumers with medical conditions, and

• Established and administered pursuant to a written plan that

– Identifies the class of persons that the program is designed to benefit, and

– Sets forth the procedures and standards for extending credit or providing other credit-related assistance under the program

4. To the extent necessary for purposes of fraud prevention or detection

5. In the case of credit for the purpose of financing medical products or services, to determine and verify the medical purpose of the loan and the use of the proceeds

6. Consistent with safe and sound banking prac­tices, if the consumer or the consumer’s legal representative requests that the creditor use medical information in determining the consum­er’s eligibility, or continued eligibility, for credit to accommodate the consumer’s particular circum­stances, and such request is documented by the creditor. For example, at the consumer’s request, a creditor may grant an exception to its ordinary policy to accommodate a medical condition that the consumer has experienced. This exception allows a creditor to consider medical information in this context, but it does not require a creditor to make such an accom­modation, nor does it require a creditor to grant a loan that is unsafe or unsound.

7. Consistent with safe and sound practices, to determine whether the provisions of a forbear­ance practice or program that is triggered by a medical condition or event apply to a consumer. For example, if a creditor has a policy of delaying foreclosure in cases in which a con­sumer is experiencing a medical hardship, this exception allows the creditor to use medical information to determine if the policy would apply to the consumer. Like exception 6 above, this exception does not require a creditor to grant forbearance; it merely provides an excep­tion so that a creditor may consider medical information in these instances.

8. To determine the consumer’s eligibility for, the

14 (11/06) • FCRA Consumer Compliance Handbook

triggering of, or the reactivation of a debt-cancellation contract or debt-suspension agree­ment if a medical condition or event is a triggering event for the provision of benefits under the contract or agreement

9. To determine the consumer’s eligibility for, the triggering of, or the reactivation of a credit insurance product if a medical condition or event is a triggering event for the provision of benefits under the product

Limits on Redisclosure of Information (Regulation V, § 222.31(b))

If a creditor subject to the medical information rules receives medical information about a consumer from a consumer reporting agency or its affiliate, the creditor must not disclose that information to any other person, except as necessary to carry out the purpose for which the information was initially disclosed or as otherwise permitted by statute, regulation, or order.

Sharing Medical Information with Affiliates (Regulation V, § 222.32(b))

In general, the exclusions from the definition of ‘‘consumer report’’ in FCRA, section 603(d)(2), allow the sharing of information among affiliates. With regard to medical information, FCRA, sec­tion 603(d)(3), provides that the exclusions in section 603(d)(2) do not apply when a person subject to the medical information rules shares information of the following types with an affiliate:

• Medical information

• An individualized list or description based on the payment transactions of the consumer for medi­cal products or services

• An aggregate list of identified consumers based on payment transactions for medical products or services

If a person that is subject to the medical rules shares with an affiliate information of one of the types listed above, the exclusions from the defini­tion of ‘‘consumer report’’ do not apply. Effectively, this means that if a person shares medical information, that person becomes a consumer reporting agency, subject to all the other substan­tive requirements of the FCRA.

The rules provide exceptions to these limitations on sharing medical information with affiliates (Regu­lation V, section 222.32(c)). A covered entity, such as a state member bank, may share medical information with its affiliates without becoming a consumer reporting agency under one or more of

Fair Credit Reporting: Examination Module 2

the following circumstances:

• In connection with the business of insurance or annuities (including the activities described in section 18B of the model Privacy of Consumer Financial and Health Information Regulation issued by the National Association of Insurance Commissioners, as in effect on January 1, 2003)

• For any purpose permitted without authorization under the regulations issued by the Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• For any purpose referred to in section 1179 of HIPAA

• For any purpose described in section 502(e) of the Gramm-Leach-Bliley Act

• In connection with a determination of the consum­er’s eligibility, or continued eligibility, for credit consistent with the financial information excep­tions or specific exceptions

• As otherwise permitted by order of an FFIEC agency

Affiliate Marketing Opt-Out (FCRA, Section 624)

FCRA, section 624, requires that consumers be provided with a notice and an opportunity to opt out of an entity’s use of certain information received from an affiliate to make solicitations to the consumer. The federal banking agencies, the National Credit Union Administration, the Federal Trade Commission, and the Securities and Exchange Commission are currently (as of August 2006) in the process of developing final regulations to implement this new opt-out requirement. Finan­cial institutions will not be subject to these requirements until the final rules are implemented and effective. This section of the examination procedures will be written upon publication of the final regulations.

Consumer Compliance Handbook FCRA • 15 (11/06)

Fair Credit Reporting—Module 2 Examination Procedures

Consumer Report and Information Sharing (FCRA, Section 603(d)) 1. Review the financial institution’s policies, proce­

dures, and practices concerning the sharing of consumer information with third parties, includ­ing both affiliated and nonaffiliated third parties. Determine the type of information shared and with whom the information is shared. (This portion of the examination may overlap with a review of the institution’s compliance with Regu­lation P, Privacy of Consumer Financial Informa­tion, which implements the Gramm-Leach-Bliley Act.)

2. Determine whether the financial institution’s information-sharing practices fall within the exceptions to the definition of a consumer report. If they do not, the financial institution could be considered a consumer reporting agency, in which case the examination proce­dures in module 6 should be completed.

3. If the financial institution shares information other than transaction and experience information with affiliates subject to opt-out provisions, determine whether the institution’s GLBA privacy notice contains information regarding how to opt out, as required by Regulation P.

4. If procedural weaknesses or other risks requir­ing further investigation are noted, obtain a sample of opt-out rights exercised by consum­ers and determine whether the financial institu­tion honored the opt-out requests by not sharing ‘‘other information’’ about those consumers with the institution’s affiliates after receiving the opt-out requests.

Protection of Medical Information (FCRA, Section 604(g); and Regulation V, Subpart D) 1. Review the financial institution’s policies, proce­

dures, and practices concerning the collection and use of consumer medical information in connection with any determination of the con­sumer’s eligibility, or continued eligibility, for credit.

2. If the financial institution’s policies, procedures, and practices allow for obtaining and using consumer medical information in the context of a credit transaction, determine whether there are adequate controls in place to ensure that the information is used only subject to the financial information exception or one of the specific exceptions set forth in Regulation V.

3. If procedural weaknesses or other risks requir­ing further investigation are noted, obtain samples of credit transactions to determine whether the use of consumer medical informa­tion was done strictly under the financial infor­mation exception or one of the specific excep­tions in Regulation V.

4. Determine whether the financial institution has adequate policies and procedures in place to limit the redisclosure of consumer medical information that was received from a consumer reporting agency or an affiliate.

5. Determine whether the financial institution shares medical information about a consumer with its affiliates. If it does, determine whether the sharing occurred in accordance with an excep­tion in Regulation V that enables the institution to share the information without becoming a con­sumer reporting agency.

Affiliate Marketing Opt-Out (FCRA, Section 624)

FCRA, section 624, requires that consumers be provided with a notice and an opportunity to opt out of an entity’s use of certain information received from an affiliate to make solicitations to the consumer. The federal banking agencies, the National Credit Union Administration, the Federal Trade Commission, and the Securities and Exchange Commission are currently (as of August 2006) in the process of developing final regulations to implement the new opt-out requirements. Finan­cial institutions will not be subject to these requirements until the final rules are implemented and effective. This section of the examination procedures will be written upon publication of the final regulations.

Consumer Compliance Handbook FCRA • 17 (11/06)

Fair Credit Reporting Examination Module 3: Disclosures to Consumers and Miscellaneous Requirements

Overview

The Fair Credit Reporting Act (FCRA) requires financial institutions to provide consumers with various notices and information under a variety of circumstances. This module deals with examina­tion responsibilities for these various areas.

Use of Consumer Reports for Employment Purposes (FCRA, Section 604(b))

FCRA, section 604(b), sets forth specific require­ments for financial institutions that obtain consumer reports on its employees or prospective employees prior to, and/or during, the term of employment. The FCRA generally requires the written permission of the consumer to procure a consumer report for ‘‘employment purposes.’’ Moreover, a clear and conspicuous disclosure that a consumer report may be obtained for employment purposes must be provided in writing to the consumer prior to procuring a report.

Prior to taking any adverse action involving employment that is based in whole or in part on the consumer report, the user generally must provide to the consumer

• A copy of the report, and

• A description in writing of the rights of the consumer, as prescribed by the Federal Trade Commission (FTC) in FCRA, section 609(c)(1).

At the time a financial institution takes adverse action in an employment situation, the consumer must also be provided with an adverse action notice, as required by FCRA, section 615, and described later in this module.

Prescreened Consumer Reports and Opt-Out Notice (FCRA, Sections 604(c) and 615(d); and FTC Regulations, Parts 642 and 698)

FCRA, section 604(c)(1)(B), allows persons, includ­ing financial institutions, to obtain and use consumer reports on any consumer in connection with any credit or insurance transaction that is not initiated by the consumer, for the purpose of making firm offers of credit or insurance. This process, known as prescreening, occurs when a financial institution obtains, from a consumer reporting agency, a list of consumers who meet certain predetermined credit­worthiness criteria and who have not elected to be

Consumer Compliance Handbook FCRA • 19 (11/06)

excluded from such lists. These lists may contain only the following information:

• The name and address of a consumer

• An identifier that is not unique to the consumer and that is used by the person solely for the purpose of verifying the identity of the consumer

• Other information pertaining to a consumer that does not identify the relationship or experience of the consumer with respect to a particular creditor or other entity

Each name on the list is considered an individual consumer report. In order to obtain and use these lists, the financial institution must make a ‘‘firm offer of credit or insurance,’’ as defined in FCRA, section 603(l), to each person on the list. The institution is not required to grant credit or insur­ance if the consumer is found to be not creditwor­thy or insurable or cannot furnish required collat­eral, provided that the underwriting criteria are determined in advance.

Example 1. Assume that a home mortgage lender obtains from a consumer reporting agency a list of everyone in county X who has a current home mortgage loan and a credit score of 700. The lender will use this list to market a second-lien home equity loan product. Besides the criteria used to create the prescreened list for this product, the lender’s criteria include a total debt-to-income ratio (DTI) of 50 percent or less. Some of these other criteria can be screened by the consumer reporting agency, but others, such as the DTI, must be determined from an applica­tion or other sources when consumers respond to the offer. If a consumer who responds to the offer has a DTI of 60 percent, the lender does not have to grant the loan.

In addition, the financial institution is allowed to obtain a full consumer report on anyone respond­ing to the offer in order to verify that the consumer continues to meet the creditworthiness criteria. If the consumer no longer meets those criteria, the institution does not have to grant the loan.

Example 2. On January 1, a credit card lender obtains from a consumer reporting agency a list of consumers in county Y who have credit scores of 720 and no previous bankruptcy records. On January 2, the lender mails solicitations offering a preapproved credit card to everyone on the list. On January 31, a consumer responds to the offer and the lender obtains and reviews a full consumer report, which shows that a bankruptcy record was added on January 15. Since this

consumer no longer meets the lender’s predeter­mined criteria, the lender is not required to issue the credit card.

These basic requirements seek to ensure that financial institutions that obtain prescreened lists follow through with an offer of credit or insurance. An institution must maintain a list of the criteria used for the product (including the criteria used to generate the prescreened list and any other criteria, such as collateral requirements) on file for three years, beginning on the date that the offer was made to the consumer.

Technical Notice and Opt-Out Requirements

FCRA, section 615(d), sets forth consumer protec­tions and technical notice requirements concerning prescreened offers of credit or insurance. The FCRA requires consumer reporting agencies that operate nationwide to jointly operate an ‘‘opt-out’’ system whereby consumers can elect to be excluded from prescreened lists by calling a toll-free number.

When a financial institution obtains and uses such lists, it must provide consumers with a ‘‘prescreen opt-out notice’’ along with a written offer of credit or insurance. The notice alerts consumers that they are receiving the offer because they meet certain creditworthiness criteria. The notice must also provide the toll-free telephone number oper­ated by the nationwide consumer reporting agen­cies for consumers to call to opt out of prescreened lists.

The FCRA sets forth the basic requirement concerning the provision of notices to consumers at the time prescreened offers are made. The FTC’s implementing regulation, which spells out the technical requirements of the notice, are at 16 CFR 642 and 698. This regulation—which is applicable to anyone, including banks, credit unions, and thrifts, that obtains and uses prescreened con­sumer reports—became effective on August 1, 2005; however, the requirement to provide a notice containing the toll-free opt-out telephone number has existed under the FCRA for many years.

Requirements Beginning August 1, 2005

The FTC regulations—16 CFR 642 and 698— require that a ‘‘short’’ notice and a ‘‘long’’ notice of the ‘‘prescreen opt-out’’ information be given with each written solicitation made to consumers on the basis of prescreened consumer reports. These regulations, which were published on January 31, 2005, at 70 FR 5022, also contain specific require­ments concerning the content and appearance of these notices. The requirements are listed below.

The short notice must be a clear and conspicu­ous, simple, and easy-to-understand statement, as follows:

• Content. The short notice must state that the consumer has the right to opt out of receiving prescreened solicitations, must provide the toll-free number, must direct consumers to the existence and location of the long notice, and must state the title of the long notice. It may not contain any other information.

• Form. The short notice must be in a type size larger than the principal text on the same page, but it may not be smaller than 12 point type. If the notice is provided by electronic means, it must be larger than the type size of the principal text on the same page.

• Location. The short notice must be on the front side of the first page of the principal promotional document in the solicitation or, if provided electronically, on the same page and in close proximity to the principal marketing message. The statement must be located so that it is distinct from other information, such as inside a border, and must be in a distinct type style, such as bolded, italicized, underlined, and/or in a color that contrasts with the principal text on the page, if the solicitation is provided in more than one color.

The long notice must also be a clear and conspicuous, simple, and easy-to-understand state­ment, as follows:

• Content. The long notice must state the informa­tion required by FCRA, section 615(d), and may not include any other information that interferes with, detracts from, contradicts, or otherwise undermines the purpose of the notice.

• Form. The long notice must appear in the solicitation and be in a type size that is no smaller than the type size of the principal text on the same page; for solicitations provided other than by electronic means, the type size may not be smaller than 8-point. The notice must begin with a heading, in capital letters and underlined, identifying the long notice as the ‘‘PRESCREEN & OPT OUT NOTICE.’’ Also, the notice must be in a type style that is distinct from the principal type style used on the same page, such as bolded, italicized, underlined, and/or in a color that contrasts with the principal text, if the solicitation is in more than one color. Further, the notice must be set apart from other text on the page, such as by including a blank line above and below the statement, and by indenting both the left and right margins from other text on the page.

Model prescreen opt-out notices developed by the FTC, along with complete sample solicitations

Fair Credit Reporting: Examination Module 3

20 (11/06) • FCRA Consumer Compliance Handbook

showing context, appear in appendix A to 16 CFR 698. The model notice text is shown below.

Sample Short Notice

You can choose to stop receiving ‘‘prescreened’’ offers of [credit or insurance] from this and other companies by calling toll-free [toll-free number]. See PRESCREEN & OPT-OUT NOTICE on other side [or other location] for more information about prescreened offers.

Sample Long Notice

PRESCREEN & OPT-OUT NOTICE: This ‘‘prescreened’’ offer of [credit or insurance] is based on information in your credit report indicating that you meet certain criteria. This offer is not guaranteed if you do not meet our criteria [including providing acceptable property as collateral]. If you do not want to receive prescreened offers of [credit or insurance] from this and other companies, call the consumer reporting agencies [or name of consumer reporting agency] toll-free, [toll-free number]; or write: [consumer reporting agency name and mailing address].

Truncation of Credit and Debit Card Account Numbers (FCRA, Section 605(g))

FCRA, section 605(g), provides that persons, including financial institutions, that accept debit and credit cards for the transaction of business are prohibited from issuing electronically generated receipts that contain more than the last five digits of the card number, or the card expiration date, at the point of sale or transaction. This requirement applies only to electronically developed receipts and does not apply to handwritten receipts or those developed with an imprint of the card.

For automatic teller machines (ATMs) and point-of-sale (POS) terminals or other machines that were put into operation before January 1, 2005, this requirement is effective on December 4, 2006. For those that were put into operation on or after January 1, 2005, the effective date is the date of installation.

Disclosure of Credit Scores by Certain Mortgage Lenders (FCRA, Section 609(g))

FCRA, section 609(g), requires financial institutions that make or arrange mortgage loans using credit scores to provide the score, with accompanying information, to applicants.

Fair Credit Reporting: Examination Module 3

Credit Score

For purposes of this section, credit score is defined as a numerical value or a categorization derived from a statistical tool or modeling system used by a person that makes or arranges a loan to predict the likelihood of certain credit behaviors, including default (the numerical value or the categorization derived from such analysis may also be referred to as a ‘‘risk predictor’’ or ‘‘risk score’’). A credit score does not include

• Any mortgage score or rating by an automated underwriting system that considers one or more factors in addition to credit information, such as the loan-to-value ratio, the amount of down payment, or the financial assets of a consumer, or

• Any other elements of the underwriting process or underwriting decision.

Covered Transactions

The disclosure requirement applies to both closed-end and open-end loans that are for consumer purposes and are secured by one- to four-family residential real properties, including purchase and refinance transactions. The requirement does not apply in circumstances that do not involve a consumer purpose, such as when a borrower obtains a loan secured by his or her residence to finance his or her small business.

Specific Required Notice

Financial institutions that are engaged in covered transactions and that use credit scores must provide a disclosure containing the specific lan­guage shown below, which is contained in FCRA, section 609(g)(1)(D):

Notice to the Home Loan Applicant

In connection with your application for a home loan, the lender must disclose to you the score that a consumer reporting agency distributed to users and the lender used in connection with your home loan, and the key factors affecting your credit scores.

The credit score is a computer generated summary calculated at the time of the request and based on information that a consumer reporting agency or lender has on file. The scores are based on data about your credit history and payment patterns. Credit scores are important because they are used to assist the lender in determining whether you will obtain a loan. They may also be used to determine what interest rate you may be offered on the mortgage. Credit scores can change over time, depending on your conduct, how your credit history and payment patterns change, and how credit scoring technologies change.

Consumer Compliance Handbook FCRA • 21 (11/06)

Fair Credit Reporting: Examination Module 3

Because the score is based on information in your credit history, it is very important that you review the credit-related information that is being furnished to make sure it is accurate. Credit records may vary from one company to another.

If you have questions about your credit score or the credit information that is furnished to you, contact the consumer reporting agency at the address and telephone number provided with this notice, or contact the lender, if the lender developed or generated the credit score. The consumer reporting agency plays no part in the decision to take any action on the loan application and is unable to provide you with specific reasons for the decision on a loan application.

If you have questions concerning the terms of the loan, contact the lender.

The notice must include the name, address, and telephone number of each consumer reporting agency that provided a credit score that was used.

Credit Score and Key Factors Disclosed

In addition to providing the notice to home loan applicants, financial institutions must disclose the credit score, the range of possible scores, the date on which the score was created, and the ‘‘key factors’’ used in calculating the score. Key factors are all relevant elements or reasons adversely affecting the credit score for the particular indi­vidual, listed in the order of their importance based on their effect on the credit score. The total number of factors to be disclosed must not exceed four. However, if one of the key factors is the number of inquiries into a consumer’s credit information, then the total number of factors must not exceed five. These key factors come from information supplied by the consumer reporting agencies with any consumer report that was furnished containing a credit score. (FCRA, section 605(d)(2))

This disclosure requirement applies to any application for a covered transaction, regardless of the final action on the application taken by the lender. The FCRA requires a financial institution to disclose all of the credit scores that were used in these transactions. For example, if two applicants jointly apply for a mortgage loan to purchase a single-family residence and the lender uses the credit scores of both, then both scores need to be disclosed. The statute specifically does not require that more than one disclosure be provided per loan; therefore, if multiple scores are used, all of them can be included in one disclosure containing the Notice to the Home Loan Applicant.

If a financial institution uses a credit score that was not obtained directly from a consumer report­ing agency but may contain some information from a consumer reporting agency, this disclosure

22 (11/06) • FCRA

requirement can be satisfied by providing a score and associated key factor information that were supplied by the consumer reporting agency. For example, certain automated underwriting systems generate scores used in credit decisions. These systems are often populated by data obtained from consumer reporting agencies. If a financial institu­tion uses such an automated system, the disclo­sure requirement can be satisfied by providing the applicants with a score and list of key factors supplied by a consumer reporting agency based on the data, including the credit score(s), that were imported into the automated system. Doing so will provide applicants with information about their credit history and its role in the credit decision, in the spirit of this section of the statute.

Timing

The statute requires that the disclosure be provided as soon as is reasonably practicable after the credit score is used.

Adverse Action Disclosures (FCRA, Sections 615(a) and (b))

The FCRA requires certain disclosures when ad­verse actions are taken with respect to consumers on the basis of information received from third parties. Specific disclosures are required depend­ing on whether the source of the information is a consumer reporting agency, a third party other than a consumer reporting agency, or an affiliate. The disclosure requirements are discussed sepa­rately below.

Information Obtained from a Consumer Reporting Agency

Section 615(a) provides that when adverse action is taken with respect to any consumer that is based in whole or in part on any information contained in a consumer report, the financial institution must do all of the following:

• Provide oral, written, or electronic notice of the adverse action to the consumer

• Provide to the consumer, orally, in writing, or electronically,

– The name, address, and telephone number of the consumer reporting agency from which it received the information (including a toll-free telephone number established by the agency, if the agency maintains files on a nationwide basis)

– A statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to give the

Consumer Compliance Handbook

Fair Credit Reporting: Examination Module 3

consumer the specific reasons for the adverse action

• Provide to the consumer an oral, written, or electronic notice of (1) the consumer’s right to obtain a free copy of the consumer report from the consumer reporting agency, within sixty days of receiving notice of the adverse action, and (2) the consumer’s right to dispute the accuracy or completeness of any information in the consumer report with the consumer report­ing agency

Information Obtained from a Source Other Than a Consumer Reporting Agency

Section 615(b)(1) provides that if credit for per­sonal, family, or household purposes involving a consumer is denied or if the charge for such credit is increased, partially or wholly on the basis of information that was obtained from a person other than a consumer reporting agency and that bears on the consumer’s creditworthiness, credit stand­ing, credit capacity, character, general reputation, personal characteristics, or mode of living, the financial institution,

• At the time the adverse action is communicated to the consumer, must clearly and accurately disclose the consumer’s right to file a written request for the reasons for the adverse action, and

• If it receives such a request within sixty days after the consumer learns of the adverse action, must disclose, within a reasonable period of time, the nature of the adverse information. The informa­tion should be sufficiently detailed to enable the consumer to evaluate its accuracy. The source of the information need not be, but may be, disclosed. In some instances, it may be impos­sible to identify the nature of certain information without also revealing the source.

Information Obtained from an Affiliate

Section 615(b)(2) provides that if a person, includ­ing a financial institution, takes an adverse action involving credit (in connection with a transaction initiated by a consumer), insurance, or employment in whole or in part on the basis of information provided by an affiliate, it must notify the consumer that the information

• Is furnished to the person taking the action by a person related by common ownership, or affili­ated by common corporate control, to the person taking the action;

• Bears upon the consumer’s creditworthiness, credit standing, credit capacity, character, gen-

Consumer Compliance Handbook FCRA • 23 (11/06)

eral reputation, personal characteristics, or mode of living;

• Is not information solely involving transactions or experiences between the consumer and the person furnishing the information; and

• Is not information in a consumer report.

The notification must inform the consumer of the adverse action and that the consumer may obtain a disclosure of the nature of the information relied on by making a written request within sixty days of transmittal of the adverse action notice. If the consumer makes such a request, the user must disclose the nature of the information received from the affiliate not later than thirty days after receiving the request.

Debt Collector Communications concerning Identity Theft (FCRA, Section 615(g))

Section 615(g) sets forth specific requirements for financial institutions that act as debt collectors, that is, financial institutions that collect debts on behalf of a third party that is a creditor or other user of a consumer report. The requirements do not apply when a financial institution is collecting its own loans. When a financial institution is notified that any information relating to a debt that it is attempting to collect may be fraudulent or may be the result of identity theft, the institution must notify the third party of this fact. In addition, if the consumer to whom the debt purportedly relates requests information about the transaction, the financial institution must provide all of the informa­tion the consumer would otherwise be entitled to if the consumer wished to dispute the debt under other provisions of law applicable to the financial institution.

Risk-Based Pricing Notice (FCRA, Section 615(h))

Section 615(h) requires users of consumer reports that grant credit on material terms that are materially less favorable than the most favorable terms available to a substantial proportion of consumers who get credit from or through that person to provide a notice to those consumers who did not receive the most favorable terms. Implementing regulations for this section are currently (as of August 2006) under development jointly by the Federal Reserve Board and the Federal Trade Commission. Financial institutions do not have to provide this notice until final regulations are implemented and effective. This section of the examination procedures will be written upon publication of final rules.

Fair Credit Reporting—Module 3 Examination Procedures

Use of Consumer Reports for Employment Purposes (FCRA, Section 604(b)) 1. Determine whether the financial institution

obtains consumer reports on current or prospec­tive employees.

2. Assess the financial institution’s policies and procedures to determine if appropriate disclo­sures are provided to current and prospective employees when consumer reports are obtained for employment purposes, including in situations in which adverse actions are taken on the basis of consumer report information.

3. If procedural weaknesses or other risks requir­ing further investigation are noted, review a sample of the disclosures to determine if they are accurate and in compliance with the techni­cal FCRA requirements.

Prescreened Consumer Reports and Opt-Out Notice (FCRA, Sections 604(c) and 615(d); and FTC Regulations, Parts 642 and 698) 1. Determine whether the financial institution

obtained and used prescreened consumer reports in connection with offers of credit and/or insurance.

2. Evaluate the institution’s policies and proce­dures to determine if a list of the criteria used for prescreened offers, including all post-application criteria, is maintained in the institution’s files and the criteria are applied consistently when con­sumers respond to the offers.

3. Determine whether written solicitations contain the required disclosures of consumers’ right to opt out of prescreened solicitations and comply with all requirements applicable at the time of the offer.

4. If procedural weaknesses or other risks requir­ing further investigation are noted, obtain and review a sample of approved and denied responses to the offers to ensure that criteria were appropriately applied.

Truncation of Credit and Debit Card Account Numbers (FCRA, Section 605(g)) 1. Determine whether the financial institution’s

Consumer Compliance Handbook FCRA • 25 (11/06)

policies and procedures ensure that electroni­cally generated receipts from automated teller machines and point-of-sale terminals or other machines do not contain more than the last five digits of the card number and do not contain the expiration date.

2. For ATMs and POS terminals or other machines that were put into operation before January 1, 2005, determine if the institution has brought the terminals into compliance or has begun a plan to ensure that these terminals comply by the mandatory compliance date of December 4, 2006.

3. If procedural weaknesses or other risks requiring further investigation are noted, review samples of actual receipts to ensure compliance.

Disclosure of Credit Scores by Certain Mortgage Lenders (FCRA, Section 609(g)) 1. Determine whether the financial institution uses

credit scores in connection with applications for closed-end or open-end loans secured by one-to four-family residential real property.

2. Evaluate the institution’s policies and proce­dures to determine whether accurate disclo­sures are provided to applicants as soon as is reasonably practicable after using credit scores.

3. If procedural weaknesses or other risks requir­ing further investigation are noted, review a sample of disclosures given to home loan applicants to determine technical compliance with the requirements.

Adverse Action Disclosures (FCRA, Sections 615(a) and (b)) 1. Determine whether the financial institution’s

policies and procedures adequately ensure that appropriate disclosures are provided when adverse action is taken against consumers on the basis of information received from consumer reporting agencies, other third parties, and/or affiliates.

2. Review the financial institution’s policies and procedures for responding to requests for information in response to these adverse action notices.

3. If procedural weaknesses or other risks requir­ing further investigation are noted, review a

Fair Credit Reporting: Examination Module 3

sample of adverse action notices to determine if they are accurate and in technical compliance.

Debt Collector Communications concerning Identity Theft (FCRA, Section 615(g)) 1. Determine whether the financial institution col­

lects debts for third parties.

2. Determine whether the financial institution has policies and procedures to ensure that the third parties are notified if the financial institution obtains any information that may indicate that the debt in question is the result of fraud or identity theft.

3. Determine if the institution has effective policies and procedures for providing information to consumers to whom the fraudulent debts relate.

4. If procedural weaknesses or other risks requir­ing further investigation are noted, review a sample of instances in which consumers have alleged identity theft and requested information

related to transactions to determine if all of the appropriate information was provided to the consumers.

Risk-Based Pricing Notice (FCRA, Section 615(h))

Section 615(h) requires users of consumer reports that grant credit on material terms that are materi­ally less favorable than the most favorable terms available to a substantial proportion of consumers who get credit from or through that person to provide a notice to those consumers who did not receive the most favorable terms. Implementing regulations for this section are currently (as of August 2006) under development jointly by the Federal Reserve Board and the Federal Trade Commission. Financial institutions do not have to provide this notice until final regulations are implemented and effective. This section of the examination procedures will be written upon pub­lication of final rules.

26 (11/06) • FCRA Consumer Compliance Handbook

Fair Credit Reporting Examination Module 4: Financial Institutions as Furnishers of Information

Overview

The Fair Credit Reporting Act (FCRA) sets forth many responsibilities for financial institutions that furnish information to consumer reporting agen­cies. Those responsibilities generally concern ensuring the accuracy of the data that are placed in the consumer reporting system. This examination module addresses the various areas associated with furnishers of information; it does not apply to financial institutions that do not furnish information to consumer reporting agencies.

Furnishers of Information—General (FCRA, Section 623)

The examination procedures for this subsection will be amended upon completion of interagency guidance for institutions regarding the accuracy and integrity of information furnished to consumer reporting agencies (the guidance is required by the Fair and Accurate Credit Transactions Act of 2003 (FACT Act)). An interagency working group will develop and publish the guidance for comment and will finalize it at a later date. The agencies will also, at a later date, write regulations regarding when furnishers must handle direct disputes from consumers.

In the interim, institutions that furnish information to consumer reporting agencies must comply with the existing FCRA requirements, which generally require accurate reporting and prompt investigation and resolution of disputes over accuracy. The examination procedures presented here are based largely on the procedures last approved by the FFIEC Task Force on Consumer Compliance in March 2000, but they have been revised to include new requirements under the 2003 amendments to the FCRA that do not require implementing regulations.

Duties of Furnishers to Provide Accurate Information

Section 623(a) states that a person, including a financial institution, may, but need not, specify an address to which consumers may send notices concerning inaccurate information. If the financial institution specifies such an address, then it may not furnish information relating to a consumer to any consumer reporting agency if (1) the institution has been notified by the consumer, at the specified address, that the information is inaccurate and (2) the information is in fact inaccurate. If the

Consumer Compliance Handbook FCRA • 27 (11/06)

financial institution does not specify an address, then it may not furnish any information relating to a consumer to any consumer reporting agency if it knows or has reasonable cause to believe that the information is inaccurate.

When a financial institution that (regularly and in the ordinary course of business) furnishes informa­tion to one or more consumer reporting agencies about its transactions or experiences with any consumer determines that any such information is not complete or accurate, the institution must promptly notify the consumer reporting agency of that determination. Corrections to that information or any additional information necessary to make the information complete and accurate must be pro­vided to the consumer reporting agency. Further, any information that remains incomplete or inaccu­rate must not thereafter be furnished to the consumer reporting agency.

If the completeness or accuracy of any informa­tion furnished by a financial institution to a con­sumer reporting agency is disputed by a con­sumer, that financial institution may not furnish the information to any consumer reporting agency without notice that the information is disputed by the consumer.

Voluntary Closures of Accounts

Section 623(a)(4) requires that any person, includ­ing a financial institution, that (regularly and in the ordinary course of business) furnishes information to a consumer reporting agency regarding a consumer who has a credit account with that institution notify the agency of the voluntary closure of the account by the consumer, in information regularly furnished for the period in which the account is closed.

Notice Involving Delinquent Accounts

Section 623(a)(5) requires that a person, including a financial institution, that furnishes information to a consumer reporting agency about a delinquent account being placed for collection, charged off, or subjected to any similar action, not later than ninety days after furnishing the information to the agency, notify the agency of the month and year of the commencement of the delinquency that immedi­ately preceded the action.

Duties upon Notice of Dispute

Section 623(b) requires the financial institution to

Fair Credit Reporting: Examination Module 4

do the following whenever it receives a notice of dispute from a consumer reporting agency regard­ing the accuracy or completeness of any informa­tion provided by the institution to the agency pursuant to FCRA, section 611 (Procedure in Case of Disputed Accuracy):

• Conduct an investigation regarding the disputed information

• Review all relevant information provided by the consumer reporting agency along with the notice

• Report the results of the investigation to the consumer reporting agency

• If the disputed information is found to be incomplete or inaccurate, report those results to all nationwide consumer reporting agencies to which the financial institution previously provided the information

• If the disputed information is incomplete, inaccu­rate, or not verifiable by the financial institution, for purposes of reporting to the consumer reporting agency,

– Modify the item of information,

– Delete the item of information, or

– Permanently block the reporting of that item of information

The investigations, reviews, and reports required to be made must be completed within thirty days. The time period may be extended for fifteen days if a consumer reporting agency receives additional relevant information from the consumer.

Prevention of Re-Pollution of Consumer Reports (FCRA, Section 623(a)(6))

Section 623(a)(6) has specific requirements for furnishers of information, including financial institu­tions, to a consumer reporting agency that receive notice from a consumer reporting agency that the information furnished may be fraudulent as a result of identity theft. FCRA, section 605B, requires consumer reporting agencies to notify furnishers of information, including financial institu­tions, that the information may be fraudulent as a result of identity theft, that an identity theft report has been filed, and that a block has been requested. Section 623(a)(6) requires financial institutions, upon receiving such notice, to estab­lish and follow reasonable procedures to ensure that this information is not re-reported to the consumer reporting agency, thus ‘‘re-polluting’’ the victim’s consumer report.

FCRA, section 615(f), also prohibits a financial institution from selling or transferring debt resulting from an alleged identity theft.

28 (11/06) • FCRA Consumer Compliance Handbook

Negative Information Notice (FCRA, Section 623(a)(7))

Section 623(a)(7) requires financial institutions to provide consumers with a notice either before negative information is provided to a nationwide consumer reporting agency or within thirty days after reporting the negative information.

Financial institutions may provide this disclosure on or with any notice of default, any billing statement, or any other materials provided to the customer, as long as the notice is clear and conspicuous. Institutions may also choose to provide this notice to all customers as an abun­dance of caution. However, this notice may not be included in the initial disclosures provided under section 127(a) of the Truth in Lending Act.

Negative Information

For these purposes, negative information is any information concerning a customer’s delinquen­cies, late payments, insolvency, or any form of default.

Nationwide Consumer Reporting Agency

FCRA, section 603(p), defines a consumer report­ing agency that compiles and maintains files on consumers on a nationwide basis as one that regularly engages in the practice of assembling or evaluating and maintaining the following two pieces of information about consumers residing nationwide, for the purpose of furnishing con­sumer reports to third parties bearing on a consumer’s creditworthiness, credit standing, or credit capacity:

• Public record information

• Credit account information from persons who furnish that information regularly and in the ordinary course of business

Model Notices

As required by the FCRA, the Federal Reserve Board developed the following model notices that financial institutions may use to comply with these requirements. One model notice is to be used when an institution chooses to provide a notice before furnishing negative information. The other is to be used when an institution provides a notice within thirty days after reporting negative information:

• Notice prior to communicating negative informa­tion (model B-1). ‘‘We may report information about your account to credit bureaus. Late payments, missed payments, or other defaults on

Fair Credit Reporting: Examination Module 4

your account may be reflected in your credit report.’’

• Notice within thirty days after communicating negative information (model B-2). ‘‘We have told a credit bureau about a late payment, missed payment or other default on your account. This information may be reflected in your credit report.’’

Use of the model notices is not required; however, proper use of the model notices provides financial institutions with a safe harbor from liability. Financial institutions may make certain changes to the language or format of the model notices without losing the safe harbor from liability provided by the models, but the changes may not be so extensive as to affect the substance, clarity, or meaningful

sequence of the language in the models. Institu­tions making such extensive revisions will lose the safe harbor from liability that the model notices provide. Acceptable changes include, for example,

• Rearranging the order of the references to ‘‘late payment(s)’’ or ‘‘missed payment(s)’’;

• Pluralizing the terms ‘‘credit bureau,’’ ‘‘credit report,’’ and ‘‘account’’;

• Specifying the particular type of account on which information may be furnished, such as ‘‘credit card account’’; and

• Rearranging, in model B-1, the phrases ‘‘informa­tion about your account’’ and ‘‘to credit bureaus’’ such that it would read ‘‘We may report to credit bureaus information about your account.’’

Consumer Compliance Handbook FCRA • 29 (11/06)

Fair Credit Reporting—Module 4 Examination Procedures

Furnishers of Information—General (FCRA, Section 623) 1. Determine whether the financial institution

provides information to consumer reporting agencies.

2. Review the financial institution’s policies and procedures for ensuring compliance with the FCRA requirements for furnishing information to consumer reporting agencies.

3. If procedural weaknesses or other risks requir­ing further investigation are noted, such as a high number of complaints from consumers regarding the accuracy of their consumer report information furnished by the financial institution, select a sample of reported items and the corresponding loan or collection file to deter­mine that the institution did the following:

a. Did not report information that it knew, or had reasonable cause to believe, was inaccurate (§ 623(a)(1)(A))

b. Did not report information to a consumer reporting agency if it was notified by the consumer that the information was inaccu­rate and the information was, in fact, inaccu­rate (§ 623(a)(1)(B))

c. Provided the consumer reporting agency with corrections or additional information to make the information complete and accu­rate, and thereafter did not send the con­sumer reporting agency the inaccurate or incomplete information (§ 623(a)(2))

d. Furnished a notice to a consumer reporting agency of a dispute in situations in which a consumer disputed the completeness or accuracy of any information the institution furnished, and the institution continued fur­nishing the information to a consumer report­ing agency (§ 623(a)(3))

e. Notified the consumer reporting agency of a voluntary account-closing by the consumer, and did so as part of the information regularly furnished for the period in which the account was closed (§ 623(a)(4))

f. Notified the consumer reporting agency of the month and year of commencement of a delinquency that immediately preceded the action of placing the delinquent account for collection, charging it off, or similar action. The notification to the agency must be made within ninety days of furnishing information to the agency about a delinquent account

being placed for collection, charged off, or subjected to any similar action (§ 623(a)(5))

4. If weaknesses within the financial institution’s procedures for investigating errors are revealed, review a sample of notices of disputes received from a consumer reporting agency and deter­mine whether the institution did the following:

a. Conducted an investigation with respect to the disputed information (§ 623(b)(1)(A))

b. Reviewed all relevant information provided by the consumer reporting agency (§ 623(b)(1)(B))

c. Reported the results of the investigation to the consumer reporting agency (§ 623(b)(1)(C))

d. Reported the results of the investigation to all other nationwide consumer reporting agen­cies to which the information was furnished, if the investigation found that the reported information was inaccurate or incomplete (§ 623(b)(1)(D))

e. Modified, deleted, or blocked the reporting of information that could not be verified

Prevention of Re-Pollution of Consumer Reports (FCRA, Section 623(a)(6)) 1. If the financial institution provides information to

a consumer reporting agency, review the insti­tution’s policies and procedures for ensuring that items of information blocked because of an alleged identity theft are not re-reported to the consumer reporting agency.

2. If weaknesses are noted within the financial institution’s policies and procedures, review a sample of notices from a consumer reporting agency of allegedly fraudulent information due to identity theft furnished by the financial institution, to determine whether the institution does not re-report the item to a consumer reporting agency.

3. If procedural weaknesses or other risks requir­ing further investigation are noted, verify that the financial institution has not sold or transferred a debt that resulted from an alleged identity theft.

Negative Information Notice (FCRA, Section 623(a)(7)) 1. If the financial institution provides negative

information to a nationwide consumer reporting

Consumer Compliance Handbook FCRA • 31 (11/06)

Fair Credit Reporting: Examination Module 4

agency, verify that the institution’s policies and procedures ensure that the appropriate notices are provided to customers.

2. If procedural weaknesses or other risks requir-

ing further investigation are noted, review a sample of notices provided to consumers to determine compliance with the technical content and timing requirements.

32 (11/06) • FCRA Consumer Compliance Handbook

Fair Credit Reporting Examination Module 5: Consumer Alerts and Identity Theft Protections

Overview

The Fair Credit Reporting Act (FCRA) contains several provisions for both consumer reporting agencies and users of consumer reports, includ­ing financial institutions, that are designed to help combat identity theft. This module applies to finan­cial institutions that are not consumer reporting agencies but are users of consumer reports.

There are two primary requirements: (1) a user of a consumer report that contains a fraud or active duty alert must take steps to verify the identity of the individual to whom the consumer report relates and (2) a financial institution must disclose certain information when consumers allege that they are the victim of identity theft.

Fraud and Active Duty Alerts (FCRA, Section 605A(h))

Initial Fraud and Active Duty Alerts

A consumer who suspects that he or she may be the victim of fraud, including identity theft, may ask nationwide consumer reporting agencies to place initial fraud alerts in his or her consumer reports. These alerts must remain in the consumer’s report for no less than ninety days. In addition, members of the armed services who are called to active duty may request that active duty alerts be placed in their consumer reports. Active duty alerts must remain in these service members’ files for no less than twelve months.

Section 605A(h)(1)(B) requires users of con­sumer reports, including financial institutions, to verify a consumer’s identity if a consumer report includes a fraud or active duty alert. Unless the financial institution uses reasonable policies and procedures to form a reasonable belief that it knows the identity of the person making the request, the financial institution may not

• Establish a new credit plan or extension of credit (other than under an open-end credit plan) in the name of the consumer,

• Issue an additional card on an existing account, or

• Increase a credit limit.

Extended Alerts

Consumers who allege that they are the victim of identity theft may also place an extended alert, which lasts seven years, on their consumer report. Extended alerts require consumers to submit

Consumer Compliance Handbook FCRA • 33 (11/06)

identity theft reports and appropriate proof of identity to the nationwide consumer reporting agencies.

Section 605A(h)(2)(B) requires a financial institu­tion that obtains a consumer report that contains an extended alert to contact the consumer in person, or by the method listed by the consumer in the alert, prior to taking any of the three actions listed above.

Information Available to Victims (FCRA, Section 609(e))

Section 609(e) requires financial institutions to provide records of fraudulent transactions to vic­tims of identity theft within thirty days after receiving a request for the records. These records include the application and business transaction records under the control of the financial institution, whether maintained by the institution or another person on behalf of the institution (such as a service provider). This information should be provided to one of the following:

• The victim

• Any federal, state, or local government law enforcement agency or officer specified by the victim in the request

• Any law enforcement agency investigating the identity theft that was authorized by the victim to take receipt of these records

The request for the records must be made by the victim in writing and must be sent to the financial institution to the address specified by the institution for this purpose. The financial institution may ask the victim to provide information, if known, regard­ing the date of the transaction or application and any other identifying information, such as an account or transaction number.

Unless the financial institution, at its discretion, otherwise has a high degree of confidence that it knows the identity of the victim making the request for information, before disclosing any information to the victim it must take prudent steps to positively identify the person requesting the information. Proof of identity can include any of the following:

• A government-issued identification card

• Personally identifying information of the same type that was provided to the financial institution by the unauthorized person

• Personally identifying information that the finan-

Fair Credit Reporting: Examination Module 5

cial institution typically requests from new appli­cants or for new transactions

At the election of the financial institution, the victim must also provide the institution with proof of an identity theft complaint, which may consist of a copy of a police report evidencing the claim of identity theft and a properly completed affidavit. The affidavit may be either the standardized affidavit form prepared by the Federal Trade Commission (published in April 2005 in the Federal Register at 70 FR 21792) or an ‘‘affidavit of fact’’ that is acceptable to the financial institution for this purpose.

When these conditions are met, the financial institution must provide the information at no

charge to the victim. However, the institution is not required to provide any information if, acting in good faith, it determines that

• Section 609(e) does not require disclosure of the information;

• It does not have a high degree of confidence in knowing the true identity of the requestor, based on the identification and/or proof provided;

• The request for information is based on a misrepresentation of fact by the requestor; or

• The information requested is Internet navigational data or similar information about a person’s visit to a web site or online service.

34 (11/06) • FCRA Consumer Compliance Handbook

Fair Credit Reporting—Module 5 Examination Procedures

Fraud and Active Duty Alerts (FCRA, Section 605A(h)) 1. Determine whether the financial institution has

effective policies and procedures in place to verify the identity of consumers in situations in which consumer reports include fraud and/or active duty military alerts.

2. Determine if the financial institution has effective policies and procedures in place to contact consumers in situations in which consumer reports include extended alerts.

3. If procedural weaknesses or other risks requiring further investigation are noted, review a sample of transactions in which consumer reports including these types of alerts were obtained. Verify that the financial institution complied with the identity verification and/or consumer contact requirements.

Information Available to Victims (FCRA, Section 609(e)) 1. Review financial institution policies, procedures,

and/or practices to determine whether identities and claims of fraudulent transactions are verified and whether information is properly disclosed to victims of identity theft and/or appropriately authorized law enforcement agents.

2. If procedural weaknesses or other risks requiring further investigation are noted, review a sample of requests of these types to determine whether the financial institution properly verified the requestor’s identity prior to disclosing the information.

Consumer Compliance Handbook FCRA • 35 (11/06)

Fair Credit Reporting Examination Module 6: Requirements for Consumer Reporting Agencies

Module 6, covering institutions that are considered consumer reporting agencies, will be added later.

Consumer Compliance Handbook FCRA • 37 (11/06)